{"id":"CVE-2026-80218","aliases":["EEF-CVE-2026-80218","EUVD-2026-81484","GHSA-3pr8-f99q-86hp"],"status":"published","title":"Sign-in token minted for one resource accepted by another in AshAuthentication","description":"Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.\n\nAshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.\n\nThis issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.","severity":{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00637,"percentile":0.5086,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2026-09-17T13:09:25Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"Hex","package":"ash_authentication","fixed_in":["4.15.0","5.0.0-rc.14"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hex","package":"ash_authentication","ranges":[{"type":"SEMVER","events":[{"introduced":"3.10.5"},{"fixed":"4.15.0"}]},{"type":"SEMVER","events":[{"introduced":"5.0.0-rc.0"},{"fixed":"5.0.0-rc.14"}]}],"versions":["3.10.5","3.10.6","3.10.7","3.10.8","3.11.0","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.15","3.11.16","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","4.0.0","4.0.0-rc.0","4.0.0-rc.1","4.0.0-rc.2","4.0.0-rc.3","4.0.0-rc.5","4.0.0-rc.6","4.0.1","4.0.2","4.0.3","4.0.4","4.1.0","4.10.0","4.11.0","4.12.0","4.13.0","4.13.1","4.13.2","4.13.3","4.13.4","4.13.5","4.13.6","4.13.7","4.14.0","4.14.1","4.14.2","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.3.0","4.3.1","4.3.10","4.3.11","4.3.12","4.3.2","4.3.3","4.3.4","4.3.5","4.3.6","4.3.7","4.3.8","4.3.9","4.4.0","4.4.1","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.4.9","4.5.0","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.8.0","4.8.1","4.8.2","4.8.3","4.8.5","4.8.6","4.8.7","4.9.0","4.9.1","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7","4.9.8","4.9.9","5.0.0-rc.0","5.0.0-rc.1","5.0.0-rc.10","5.0.0-rc.11","5.0.0-rc.12","5.0.0-rc.13","5.0.0-rc.2","5.0.0-rc.3","5.0.0-rc.4","5.0.0-rc.5","5.0.0-rc.6","5.0.0-rc.7","5.0.0-rc.8","5.0.0-rc.9"]}],"products":[{"vendor":"team-alembic","product":"ash_authentication"}],"references":[{"url":"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3pr8-f99q-86hp","tags":["vendor-advisory","related","advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-80218.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-80218","tags":["related","web"]},{"url":"https://github.com/team-alembic/ash_authentication/commit/eca8cadea0f1595ed2c10a0c177b1da9aa9e5269","tags":["related","fix","web"]},{"url":"https://github.com/team-alembic/ash_authentication/commit/2640e1872e1fef4e4606e601bf00102cff784c03","tags":["patch","fix"]},{"url":"https://github.com/team-alembic/ash_authentication/commit/7baac243ca651eee127a84d672eee3fcff42e598","tags":["patch","fix"]},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80218.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80218","tags":["advisory"]},{"url":"https://github.com/team-alembic/ash_authentication","tags":["package"]},{"url":"https://hex.pm/packages/ash_authentication","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-80218","title":"Sign-in token minted for one resource accepted by another in AshAuthentication","description":"Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.\n\nAshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.\n\nThis issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.","status":"published","published":"2026-09-17T13:09:25.585Z","modified":"2026-09-17T18:28:47.571Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:45:36.695039Z"}],"euvd":[{"id":"EUVD-2026-81484","description":"Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.\n\nAshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.\n\nThis issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.","status":"published","published":"2026-09-17T13:09:25Z","modified":"2026-09-17T18:28:47Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:10.833571Z"}],"nvd":[{"id":"CVE-2026-80218","description":"Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.\n\nAshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.\n\nThis issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.","status":"published","published":"2026-09-17T14:17:30.743Z","modified":"2026-09-18T18:16:18.527Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:49.013904Z"}],"osv":[{"id":"CVE-2026-80218","title":"Sign-in token minted for one resource accepted by another in AshAuthentication","description":"Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.\n\nAshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.\n\nThis issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.","status":"published","published":"2026-09-17T13:09:25.585Z","modified":"2026-10-28T02:30:31.61588201Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"EEF-CVE-2026-80218","title":"Sign-in token minted for one resource accepted by another in AshAuthentication","description":"## Summary\n\nImproper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.\n\n`AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2` parses the JWT `sub` claim (for example `user?id=1`) with `URI.parse/1` and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: `AshAuthentication.Jwt.verify/3` checks the signature, `exp`, `nbf`, `jti` and the library-version claims, the purpose check only requires `sign_in`, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.\n\nThis issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.","status":"published","published":"2026-09-17T13:09:25.585Z","modified":"2026-09-17T13:26:03.729128908Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}